using ZB.MOM.WW.ScadaBridge.Security.Auth;
using Xunit;

namespace ZB.MOM.WW.ScadaBridge.Security.Tests;

public class DisableLoginGuardTests
{
    [Theory]
    [InlineData("Production")]
    [InlineData("Staging")]
    [InlineData("")]
    public void Validate_DisableLoginOutsideDevelopment_WithoutAck_Throws(string env)
    {
        var ex = Assert.Throws<InvalidOperationException>(
            () => DisableLoginGuard.Validate(disableLogin: true, environmentName: env, allowOutsideDevelopment: false));
        Assert.Contains("DisableLogin", ex.Message);
        Assert.Contains("Development", ex.Message);
    }

    [Theory]
    [InlineData("Development", false)] // dev env: allowed without ack
    [InlineData("development", false)] // case-insensitive env name
    [InlineData("Production", true)]   // explicit second ack key
    public void Validate_Allowed_DoesNotThrow(string env, bool ack)
        => DisableLoginGuard.Validate(true, env, ack);

    [Fact]
    public void Validate_FlagOff_NeverThrows()
        => DisableLoginGuard.Validate(false, "Production", false);
}